@kynver-app/runtime 0.1.8 → 0.1.10

package/dist/cli.js

@@ -1,8 +1,7 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { mkdirSync as mkdirSync5 } from "node:fs";
-import path14 from "node:path";
+import { mkdirSync as mkdirSync5, realpathSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 // src/config.ts
@@ -153,6 +152,8 @@ function saveApiKey(apiKey) {
   saveCredentialsFile({ ...loadCredentialsFile(), apiKey });
 }
 function loadRunnerToken(agentOsId) {
+  const envToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
+  if (envToken) return envToken;
   const creds = loadCredentialsFile();
   if (!creds.runnerToken) return void 0;
   if (agentOsId && creds.runnerTokenAgentOsId && creds.runnerTokenAgentOsId !== agentOsId) {
@@ -168,11 +169,15 @@ function saveRunnerToken(agentOsId, token) {
   });
 }
 function resolveBaseUrl(argsBaseUrl) {
-  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
+  const baseUrl = resolveConfiguredBaseUrl(argsBaseUrl);
   if (!baseUrl) failConfig("requires --base-url, KYNVER_API_URL, OPENCLAW_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl");
-  return trimTrailingSlash(String(baseUrl));
+  return baseUrl;
+}
+function resolveConfiguredBaseUrl(argsBaseUrl) {
+  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
+  return baseUrl ? trimTrailingSlash(String(baseUrl)) : void 0;
 }
-function resolveCallbackSecret(argsSecret, agentOsId) {
+function resolveConfiguredCallbackSecret(argsSecret, agentOsId) {
   const scoped = argsSecret || loadRunnerToken(agentOsId) || loadRunnerToken(loadUserConfig().agentOsId);
   if (scoped) return String(scoped);
   const globalSecret = process.env.KYNVER_RUNTIME_SECRET || process.env.OPENCLAW_CRON_SECRET;
@@ -182,8 +187,24 @@ function resolveCallbackSecret(argsSecret, agentOsId) {
     );
     return String(globalSecret);
   }
+  return void 0;
+}
+async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
+  if (configured) return configured;
+  const apiKey = loadApiKey();
+  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
+  if (apiKey && agentOsId && baseUrl) {
+    try {
+      const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
+      saveRunnerToken(agentOsId, token);
+      return token;
+    } catch (error) {
+      failConfig(`runner credential mint failed: ${error.message}`);
+    }
+  }
   failConfig(
-    "requires --secret, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, or (legacy) KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET"
+    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET"
   );
 }
 async function fetchRunnerCredential(agentOsId, opts) {
@@ -359,12 +380,12 @@ var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
 var DEFAULT_MAX_USED_PERCENT = 80;
 var DEFAULT_HARD_MAX_USED_PERCENT = 90;
 function observeRunnerDiskGate(input = {}) {
-  const path15 = input.diskPath?.trim() || "/";
+  const path14 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync(path15);
+  const stats = statfsSync(path14);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -384,7 +405,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path15,
+    path: path14,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -1057,7 +1078,7 @@ async function dispatchRun(args) {
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-    const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+    const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
     const execute = args.execute === true || args.execute === "true";
     const dryRun = !execute;
     const leaseOwner = `openclaw-harness:${run.id}`;
@@ -1201,7 +1222,7 @@ async function sweepRun(args) {
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-    const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+    const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
     const leaseOwner = `openclaw-harness:${run.id}`;
     const releasedLocalOrphans = [];
     for (const name of Object.keys(run.workers || {})) {
@@ -1319,7 +1340,7 @@ async function tryCompleteWorker(args) {
     return { ok: true, skipped: true, reason: "worker-not-finished" };
   }
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/harness/completion`;
   const body = {
     source: "openclaw-harness",
@@ -1476,7 +1497,7 @@ import path12 from "node:path";
 // src/plan-progress-sync.ts
 async function syncPlanProgress(args) {
   const base = resolveBaseUrl(args.baseUrl);
-  const secret = resolveCallbackSecret(args.secret, args.agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret, args.agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(args.agentOsId)}/tasks/${encodeURIComponent(args.taskId)}/plan-progress-sync`;
   const res = await postJson(url, secret, {
     phase: args.phase,
@@ -1525,7 +1546,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
 // src/workspace-runtime-config.ts
 async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/runtime`;
   try {
     const res = await getJson(url, secret);
@@ -1568,7 +1589,7 @@ async function completeFinishedWorkers(runId, args) {
 }
 async function postOperatorTick(agentOsId, runId, resourceGate, args) {
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/operator/tick`;
   const res = await postJson(url, secret, {
     agentOsId,
@@ -1692,7 +1713,7 @@ async function emitPlanProgress(args) {
     evidence.push(parseEvidenceArg(rawEvidence));
   }
   const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
-  const secret = resolveCallbackSecret(args.secret ? String(args.secret) : void 0, agentOsId);
+  const secret = await resolveCallbackSecretWithMint(args.secret ? String(args.secret) : void 0, agentOsId, { baseUrl: base });
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/plans/${encodeURIComponent(planId)}/progress-events`;
   const cfg = loadUserConfig();
   const provider = cfg.workerProvider ? `provider:${cfg.workerProvider}` : void 0;
@@ -1807,6 +1828,7 @@ async function main(argv = process.argv.slice(2)) {
   } else {
     rest = argv;
   }
+  if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
   mkdirSync5(runsDir, { recursive: true });
@@ -1829,7 +1851,7 @@ async function main(argv = process.argv.slice(2)) {
   if (scope === "worker" && action === "complete") return void await completeWorker(args);
   unknownCommand(scope, action);
 }
-var isCliEntry = process.argv[1] && path14.resolve(process.argv[1]) === path14.resolve(fileURLToPath(import.meta.url));
+var isCliEntry = process.argv[1] && realpathSync.native(process.argv[1]) === realpathSync.native(fileURLToPath(import.meta.url));
 if (isCliEntry) {
   void main().catch((error) => {
     console.error(error);